Internal matters are just that, internal matters. You cannot enforce information transfer controls (without prior agreement with that person) because you allegedly paid someone to produce data, and want to make money off of it.